General

  • Target

    b2594a07e509fd84e8442f56d133da5f47187fadb1c5436e83837d9a2cb1daa4.bin

  • Size

    4.6MB

  • Sample

    240529-22ywhaeb86

  • MD5

    a6f0df10975edd563e7643fc7b425e02

  • SHA1

    f8962ffc94e2095e523f5fd7be3ecec038ec5df0

  • SHA256

    b2594a07e509fd84e8442f56d133da5f47187fadb1c5436e83837d9a2cb1daa4

  • SHA512

    346b38aaff32dcd39746010d1c756efcb6f58561da2c13477178a73d3180cada15254e30ce02bdefd042651d21faa295a7746e54d1480df7e7e17d91e4c682b9

  • SSDEEP

    98304:DPO1mYfS4/qPxTV5YCEMaz9TZ9q5DxP0RYBSijwMCF2RxM:TYfryP/eCvaz9De10RYBwMCF2RxM

Malware Config

Extracted

Family

godfather

C2

https://t.me/bavazarikopsared

Targets

    • Target

      b2594a07e509fd84e8442f56d133da5f47187fadb1c5436e83837d9a2cb1daa4.bin

    • Size

      4.6MB

    • MD5

      a6f0df10975edd563e7643fc7b425e02

    • SHA1

      f8962ffc94e2095e523f5fd7be3ecec038ec5df0

    • SHA256

      b2594a07e509fd84e8442f56d133da5f47187fadb1c5436e83837d9a2cb1daa4

    • SHA512

      346b38aaff32dcd39746010d1c756efcb6f58561da2c13477178a73d3180cada15254e30ce02bdefd042651d21faa295a7746e54d1480df7e7e17d91e4c682b9

    • SSDEEP

      98304:DPO1mYfS4/qPxTV5YCEMaz9TZ9q5DxP0RYBSijwMCF2RxM:TYfryP/eCvaz9De10RYBwMCF2RxM

    Score
    4/10
    • Target

      i.apk

    • Size

      3.9MB

    • MD5

      9f13cf568be897169486642fb1580013

    • SHA1

      d3702031233d6c442bbacb5c1bd43eca6e02517e

    • SHA256

      320962fdfaf126f942e173d8e3e7aa6c5da3577fa538c16796bd10e8166fa5a7

    • SHA512

      124070450df268f5871835f0cd0a63dcd48453871a7365446621ec0959f1f8a2eb6196a683ef3085234d108191cfa6e8fc0ab9949b117ab9f7ce23e05564b8ea

    • SSDEEP

      98304:ZpHsoushcDd/xTNAumRbLzHtq3xd5+HarQAFdeU4pQlJKqKgzRos:Zp/u7/AumbnN8N+HarX4pQegzJ

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Prevents application removal

      Application may abuse the framework's APIs to prevent removal.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Acquires the wake lock

MITRE ATT&CK Mobile v15

Tasks